1092d34c39
- Add k8s/ manifests (StatefulSet, kustomize, PDB, ServiceMonitor) + docs/runbooks/kubernetes.md - Add tidal-server/src/openapi.rs (utoipa OpenAPI spec) and wire into router - Add docs/guides/ (build-a-feed-app, embeddings, server-deployment) + foryou_feed example - Consolidate tidal/docker/ into root docker/ (single canonical home) - Update API.md, QUICKSTART.md, README.md, CLAUDE.md, check-docs.sh accordingly
26 lines
961 B
YAML
26 lines
961 B
YAML
# EXAMPLE ONLY — do not apply this as-is and do not commit a real key.
|
|
#
|
|
# The server reads TIDAL_API_KEY and requires `Authorization: Bearer <key>` on
|
|
# every data route when it is set. If the key is empty/unset the server runs
|
|
# UNAUTHENTICATED and logs a loud startup WARN — never do that on a real network.
|
|
#
|
|
# This file is intentionally LEFT OUT of kustomization.yaml. Create the real
|
|
# secret out-of-band so the key never lands in git:
|
|
#
|
|
# kubectl -n tidaldb create secret generic tidaldb-api-key \
|
|
# --from-literal=api-key="$(openssl rand -hex 32)"
|
|
#
|
|
# or manage it with your secret store (External Secrets Operator, Sealed
|
|
# Secrets, Vault Agent, etc.). The StatefulSet mounts key `api-key` from the
|
|
# secret named `tidaldb-api-key`.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: tidaldb-api-key
|
|
namespace: tidaldb
|
|
labels:
|
|
app.kubernetes.io/name: tidaldb
|
|
type: Opaque
|
|
stringData:
|
|
api-key: "CHANGE-ME-use-a-32-byte-random-hex-string"
|